Exposed Server Leaks TheGentlemen Ransomware Toolkit, Credentials, and Ngrok Tokens

Hunt.io discovered an exposed open directory on a Proton66-hosted server containing a structured TheGentlemen ransomware toolkit — including a 35 KB z1.bat pre-encryption orchestration script, Mimikatz credential logs with NTLM hashes, hardcoded ngrok authentication tokens, and numerous offensive utilities — demonstrating active, operational ransomware activity and providing high-confidence IOCs and TTPs for defenders.